Northbound interface security assurance method, architecture, and electronic equipment

Abstract

The present invention provides a northbound interface security assurance method, architecture, and electronic device. The method includes: receiving an access request sent by a northbound application; querying whether the access request has access rights, and when the access rights are granted, sending a legitimate access request to a controller of a control plane; obtaining the number of unauthorized accesses by the northbound application between the legitimate access request and the previous legitimate access request; obtaining state parameters of the controller before and after responding to the legitimate access request, and obtaining a control state evaluation value of the controller based on the state parameters; obtaining state data of the network domain acted upon by the northbound application before and after responding to the legitimate access request on a data plane interacting with the control plane, and obtaining a network state evaluation value of the network domain based on the state data; updating the trust value of the application based on the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value; and adjusting the permissions of the application based on the updated trust value. This method has excellent security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a northbound interface security assurance method, architecture, and electronic equipment. Background Art

[0002] SDN (Software Defined Network) is a new and innovative network architecture. Its core technology, OpenFlow, separates the control and data planes of network devices, enabling flexible control of network traffic. However, with the increasing variety of applications, the resulting network security issues cannot be ignored. Because the vast majority of applications are developed by different vendors, third-party applications obtained from various sources may contain flaws, vulnerabilities, and even malicious logic. Since application-layer applications can access and modify data-layer resources through northbound interfaces, malicious applications can pose a serious threat to SDN networks.

[0003] In related technologies, a paper [1] (Ke Haijuan. Research on Northbound Interface Access Control of Heterogeneous SDN Controller Architecture [D]. Xidian University, 2020. DOI: 10.27389 / d.cnki.gxadu.2020.001751) proposes an intermediate proxy access control scheme based on Software Guard Extensions (SGX). This scheme combines SGX technology to implement a delegate agent access control scheme that supports arbitrary access policies. The delegate agent runs on a trusted platform outside the controller. The controller sends the local access policy to the delegate agent. The delegate agent acts as an intermediate layer of the northbound interface and monitors whether the application's access to its northbound interface is legal. Patent [CN202110481261.X] proposes an SDN application security management method and architecture based on access control. By implementing access control on the application's REST API call, the application is securely deployed to prevent malicious applications from deliberately damaging the SDN network. The permission detection component verifies the authenticity and legitimacy of applications through static analysis based on a sensitive API checklist. Only applications that pass this verification are authorized to call the REST API. The database is responsible for storing and updating the sensitive API checklist and application information table.

[0004] However, among the above methods, the method in the paper [1] requires the deployment of an SGX environment on the application installation device and controller, which makes this solution difficult to implement and difficult to promote on a large scale. The method in the patent requires obtaining all byte codes for static analysis, but it is difficult to obtain the byte codes of the applications used in actual application scenarios. In addition, both of the above methods monitor access to northbound applications in stages, and do not monitor the entire access process to dynamically adjust the access rights of northbound applications in real time. Summary of the Invention

[0005] The present invention provides a northbound interface security assurance method, architecture, and electronic device to address the defects of the prior art in that access control is not refined and dynamically managed and the access process of applications is only monitored in stages. This method implements a more fine-grained access control method based on trust and provides comprehensive security assurance for the entire process of northbound application access.

[0006] The present invention provides a northbound interface security assurance method, comprising:

[0007] Receive access requests from northbound applications;

[0008] querying whether the access request has access rights, and when the access request has access rights and is a legitimate access request, sending the legitimate access request to a controller of the control plane;

[0009] Obtaining a number of unauthorized accesses by the northbound application between the legitimate access request and a previous legitimate access request;

[0010] acquiring state parameters of the controller before responding to the legitimate access request and state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request;

[0011] Obtaining, on a data plane interacting with the control plane, state data of the network domain on which the northbound application acts before responding to the legitimate access request and state data of the network domain on which the northbound application acts after responding to the legitimate access request, to obtain a network status evaluation value of the network domain based on the state data of the network domain before and after responding to the legitimate access request;

[0012] updating the trust value of the application according to the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value;

[0013] The permissions of the application are adjusted according to the updated trust value of the application.

[0014] According to a northbound interface security assurance method provided by the present invention, obtaining the state parameters of the controller before responding to the legitimate access request and the state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request, includes:

[0015] Acquire multiple state parameters of the controller before responding to the legal access request and multiple state parameters of the controller after responding to the legal access request;

[0016] Pre-setting graded indicator thresholds for each of the state parameters;

[0017] Calculating a change value of each state parameter of the controller before and after responding to the legal access request;

[0018] Determining a state loss score for each state parameter according to an indicator threshold corresponding to a change value of each state parameter;

[0019] A control state evaluation value of the controller is obtained based on the state loss scores of the plurality of state parameters.

[0020] According to a northbound interface security assurance method provided by the present invention, obtaining, on a data plane interacting with the control plane, state data of a network domain acted upon by the northbound application before responding to the legitimate access request and state data of the network domain acted upon by the northbound application after responding to the legitimate access request, to obtain a network status evaluation value of the network domain based on the state data of the network domain before and after responding to the legitimate access request, includes:

[0021] Acquire, on a data plane interacting with the control plane, a plurality of status data of the network domain on which the northbound application acts before responding to the legitimate access request and a plurality of status data of the network domain on which the northbound application acts after responding to the legitimate access request;

[0022] Aggregating multiple state data of the network domain through a Bayesian network model or a Markov network model to obtain a network state evaluation value of the network domain;

[0023] The status data includes the bandwidth, packet loss rate and network delay of the network domain.

[0024] According to a northbound interface security assurance method provided by the present invention, updating the trust value of the application according to the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value includes:

[0025] Determine weights of the number of unauthorized accesses, the control status evaluation value, and the network status evaluation value according to a fuzzy comprehensive evaluation method;

[0026] Performing a weighted summation of the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value according to the weight value to obtain a trust impact value;

[0027] Based on the trust impact value and the trust value of the application before the update, the current trust value of the application is obtained and updated.

[0028] According to a northbound interface security assurance method provided by the present invention, before querying whether the access request has access rights, the method further includes:

[0029] The identity token in the access request is verified. If the verification is passed, the identity authentication is successful and the access request is issued. If the verification is not passed, the identity authentication fails and the access request is discarded.

[0030] According to a northbound interface security assurance method provided by the present invention, before receiving an access request sent by a northbound application, the method further includes:

[0031] Receive service registration information sent by the northbound application before it goes online, and generate an identity token and initial access rights for the northbound application according to the service registration information.

[0032] The present invention also provides a northbound interface security assurance architecture, comprising: a northbound interface access agent, a trust assessment engine and an access control engine, wherein the trust assessment engine comprises an access request assessment module, a controller status assessment module, a network status assessment module and a multi-mode feature fusion trust assessment module;

[0033] The northbound interface access agent is used to receive an access request sent by a northbound application, query whether the access request has access rights, and when the access request has access rights and is a legitimate access request, send the legitimate access request to the controller of the control plane;

[0034] The access request evaluation module is used to obtain the number of unauthorized accesses by the northbound application between the legitimate access request and the previous legitimate access request;

[0035] The controller state evaluation module is used to obtain state parameters of the controller before responding to the legitimate access request and state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request;

[0036] The network status evaluation module is used to obtain, on a data plane interacting with the control plane, status data of the network domain acted upon by the northbound application before responding to the legitimate access request and status data of the network domain acted upon by the northbound application after responding to the legitimate access request, so as to obtain a network status evaluation value of the network domain based on the status data of the network domain before and after responding to the legitimate access request;

[0037] The multi-mode feature fusion trust evaluation module is used to update the trust value of the application according to the number of unauthorized accesses, the control state evaluation value and the network state evaluation value;

[0038] The access control engine adjusts the permissions of the application according to the updated trust value of the application.

[0039] According to a northbound interface security assurance architecture provided by the present invention, before querying whether the access request has access rights, the northbound interface access agent is also used to: verify the identity token in the access request, if the verification is passed, the identity authentication is successful, and the access request is issued; if the verification is not passed, the identity authentication fails, and the access request is discarded.

[0040] A northbound interface security assurance architecture provided by the present invention further includes:

[0041] The identity security infrastructure is used to receive service registration information sent by the northbound application before it goes online, and generate an identity token and initial access rights for the northbound application based on the service registration information.

[0042] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-described northbound interface security assurance methods is implemented.

[0043] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the northbound interface security assurance method described above is implemented.

[0044] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned northbound interface security assurance methods.

[0045] The northbound interface security assurance method, architecture, and electronic device provided by the present invention perform long-term trust evaluation on the access process of northbound applications by evaluating the controller status, network status, and access request information, and adjust the permissions of northbound applications based on the evaluation results. On the one hand, this method does not require static analysis of the byte code of northbound applications, does not change the access logic of northbound applications, and does not require deployment of a specific environment. On the other hand, the access control mechanism for northbound applications in this method comprehensively considers multiple factors, performs refined management of access control of northbound applications, and manages the access permissions of northbound applications based on trust evaluation, which can effectively respond to malicious behavior of northbound applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 It is a flowchart of the northbound interface security assurance method provided by the present invention;

[0048] Figure 2 1 is a flow chart of a method for obtaining a control state evaluation value of a controller provided by the present invention;

[0049] Figure 3 It is a flowchart of a method for obtaining a network status evaluation value of a network domain provided by the present invention;

[0050] Figure 4 1 is a flow chart of a method for obtaining a trust value of an updated application program provided by the present invention;

[0051] Figure 5 This is one of the structural diagrams of the northbound interface security assurance architecture provided by the present invention;

[0052] Figure 6 This is the second structural diagram of the northbound interface security assurance architecture provided by the present invention;

[0053] Figure 7 This is the third structural diagram of the northbound interface security assurance architecture provided by the present invention;

[0054] Figure 8 This is the fourth structural diagram of the northbound interface security assurance architecture provided by the present invention;

[0055] Figure 9 It is a structural schematic diagram of the electronic device provided by the present invention.

[0056] Reference numerals:

[0057] 101. Northbound application; 102. Northbound interface access agent; 103. Control plane; 104. Data plane; 105. Access control engine; 106. Trust assessment engine; 107. Identity security infrastructure; 910. Processor; 920. Communication interface; 930. Memory; 940. Communication bus. DETAILED DESCRIPTION

[0058] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0059] The following combination Figure 1-Figure 4 A northbound interface security assurance method of the present invention is described, the method comprising:

[0060] S101: Receive an access request sent by a northbound application.

[0061] S102: Query whether the access request has access rights. If the access request has access rights and is a legal access request, send the legal access request to a controller of the control plane.

[0062] S103: Obtain the number of unauthorized accesses by the northbound application between the legal access request and the previous legal access request.

[0063] S104: Acquire state parameters of the controller before responding to the legal access request and state parameters of the controller after responding to the legal access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legal access request.

[0064] S105: Obtain, on the data plane interacting with the control plane, the status data of the network domain on which the northbound application acts before responding to the legitimate access request and the status data of the network domain on which the northbound application acts after responding to the legitimate access request, so as to obtain a network status evaluation value of the network domain based on the status data of the network domain before and after responding to the legitimate access request.

[0065] S106: Update the trust value of the application according to the number of unauthorized accesses, the control status evaluation value, and the network status evaluation value.

[0066] S107: Adjust the permissions of the application program according to the updated trust value of the application program.

[0067] Specifically, the application layer has multiple northbound applications, which receive access requests sent by each northbound application. It queries whether the received access request has access rights. If it does not have access rights, it directly intercepts the access request. If the access request has access rights and is a legitimate access request, it sends the legitimate access request to the controller of the control plane. Querying whether the access request has access rights means querying whether the access request is within the access rights of the northbound application that issued the access request. If the access request exceeds the access rights of the northbound application, it does not have access rights. Among them, each northbound application in the application layer corresponds to a controller, which further acts as a network domain in the data plane.

[0068] After issuing a legal access request, the controller begins to respond to the legal access request and adjusts the control strategy based on a single response.

[0069] The specific adjustment method is to first obtain the number of unauthorized access requests sent by the northbound application between this legitimate access request and the previous legitimate access request, that is, to obtain the number of unauthorized access requests TO i Unauthorized access requests are access requests that exceed the permissions of northbound applications. Such access requests will be directly intercepted due to permission issues. Unauthorized access requests are also illegal access requests.

[0070] Secondly, the controller's state parameters before and after responding to the legitimate access request are obtained. Based on the changes in the controller's state parameters before and after responding to the legitimate access request, a control state evaluation value of the controller can be calculated. Before responding to the legitimate access request and after responding to the legitimate access request refer to before the legitimate access request begins and after the legitimate access request ends, respectively. The controller's state parameters may include CPU load rate, disk busyness, response latency, and memory utilization.

[0071] Finally, the data plane interacts with the control plane. Each northbound application operates on a corresponding network domain on the data plane. Status data for the network domain on which the northbound application operates is obtained before and after responding to the legitimate access request. Based on this acquired status data, a network status assessment value for the corresponding network domain can be obtained. This network domain status data includes bandwidth, packet loss rate, and network latency.

[0072] In summary, after obtaining the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value, the trust value of the northbound application is reassessed based on the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value, and the trust value of the northbound application is updated. The permissions of the application can be adjusted based on the updated trust value of the application.

[0073] For example, as described in the following table, it is a list of permission categories for northbound applications. It can be understood that the higher the credit value of a northbound application, the higher the permission of the northbound application will be adjusted.

[0074]

[0075]

[0076] The northbound interface security assurance method provided by the present invention performs a long-term trust assessment on the access process of northbound applications by evaluating the controller status, the network status, and the access request information, and adjusts the permissions of the northbound applications based on the assessment results. On the one hand, this method does not require static analysis of the byte code of the northbound application, does not change the access logic of the northbound application, and does not require the deployment of a specific environment. On the other hand, this method comprehensively considers multiple factors for the access control mechanism of the northbound application, performs refined management of the access control of the northbound application, and manages the access rights of the northbound application based on the trust assessment, which can effectively respond to malicious behavior of the northbound application.

[0077] In one embodiment, Figure 2 As shown, the acquiring of the state parameters of the controller before responding to the legitimate access request and the state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request, includes:

[0078] S201: Acquire multiple state parameters of the controller before responding to the legal access request and multiple state parameters of the controller after responding to the legal access request.

[0079] S202: Pre-set graded indicator thresholds for each of the state parameters.

[0080] S203: Calculate the change value of each state parameter of the controller before and after responding to the legal access request.

[0081] S204: Determine a state loss score of each state parameter according to an indicator threshold corresponding to a change value of each state parameter.

[0082] S205: Obtaining a control state evaluation value of the controller based on the state loss scores of the plurality of state parameters.

[0083] Specifically, multiple controller status parameters, such as CPU load, disk busyness, response latency, and memory utilization, are obtained before and after responding to legitimate access requests. Each status parameter has a corresponding hierarchical indicator threshold. This means that the status parameter is divided into multiple levels, and each level has a corresponding indicator threshold.

[0084] For each state parameter, calculate the change value before and after responding to the legitimate access request, determine which level of indicator threshold the change value exceeds, and based on the indicator threshold, obtain the state loss score corresponding to the state parameter. Based on the state loss scores of multiple state parameters, the control state evaluation value of the controller can be obtained through the following formula:

[0085]

[0086] Among them, TC i,c e represents the control state evaluation value of the controller that has interacted with northbound application i at time c, where time c refers to the time when the legal access request ends; j,c Represents the state loss fraction of the jth (j=1,…n) state parameter of the controller at time c; J is the number of categories of state parameters.

[0087] In one embodiment, Figure 3 As shown in , the obtaining, on the data plane interacting with the control plane, the status data of the network domain acted upon by the northbound application before responding to the legitimate access request and the status data of the network domain acted upon by the northbound application after responding to the legitimate access request, to obtain a network status evaluation value of the network domain based on the status data of the network domain before and after responding to the legitimate access request, includes:

[0088] S301: Acquire, on a data plane interacting with the control plane, a plurality of status data of the network domain on which the northbound application acts before responding to the legitimate access request and a plurality of status data of the network domain on which the northbound application acts after responding to the legitimate access request.

[0089] S302: Aggregating multiple status data of the network domain through a Bayesian network model or a Markov network model to obtain a network status evaluation value of the network domain; wherein the status data includes the bandwidth, packet loss rate and network delay of the network domain.

[0090] Specifically, when executing a legitimate access request, the controller interacts with the data plane to obtain status data of the network domain on which the northbound application acts before and after responding to the legitimate access request. The status data of the network domain includes the bandwidth, packet loss rate and network delay of the network domain.

[0091] By aggregating the bandwidth, packet loss rate and network delay of the network domain through the Bayesian network model or the Markov network model, the network status evaluation value TP of the network domain can be obtained. i,c .

[0092] The network status evaluation value is mainly obtained by analyzing the status data collected on the data plane before and after responding to legitimate access requests. First, the status data of the network domain affected by the northbound application on the data plane is monitored in real time, and the monitoring results are collected: the bandwidth TW of the network domain before the legitimate access request is accessed a , Packet Loss Rate LD a , and time delay TD a ; The bandwidth of the network domain after the legitimate access request is completed TW b , Packet Loss Rate LD b and time delay TD b A network bandwidth threshold value TH_tw, a packet loss rate threshold value TH_ld, and a delay threshold value TH_td are obtained, wherein the network bandwidth threshold value TH_tw, the packet loss rate threshold value TH_ld, and the delay threshold value TH_td are set according to attributes of the data plane.

[0093] Secondly, calculate Po and Ne as follows. The initial values of Po and Ne are 0. If TW a -TW b Greater than TH_tw, then Po increases by 1, otherwise Ne increases by 1; if LD b -LD a Greater than TH_ld, then Po increases by 1, otherwise Ne increases by 1; if TD b -TD a If it is lower than TH_td, Po increases by 1, otherwise Ne increases by 1.

[0094] There are one or more networks that the northbound application acts on. After monitoring each network domain to obtain all the data required to calculate Po and Ne, the trust evaluation module first checks the network domain that the northbound application acts on, and aggregates the Po of the network domain k that the northbound application acts on. k and Ne k Calculate the network status evaluation value TP related to time c and northbound application i i,c :

[0095]

[0096] Where K represents the number of network domains that northbound application i acts on, Po k represents Po, Ne calculated by the kth network domain k Represents Ne calculated for the kth network domain.

[0097] In one embodiment, Figure 4 As shown in , updating the trust value of the application according to the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value includes:

[0098] S401: Determine weights of the number of unauthorized accesses, the control status evaluation value, and the network status evaluation value according to a fuzzy comprehensive evaluation method.

[0099] S402: Performing a weighted sum of the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value according to the weight value to obtain a trust impact value.

[0100] S403: Based on the trust impact value and the trust value of the application before the update, obtain and update the current trust value of the application.

[0101] Specifically, the weights for the number of unauthorized accesses, control status assessment value, and network status assessment value are determined using the fuzzy comprehensive evaluation method. The fuzzy comprehensive evaluation method is a comprehensive evaluation method based on fuzzy mathematics. It converts qualitative evaluations into quantitative evaluations based on fuzzy mathematics' membership theory. This method uses fuzzy mathematics to make an overall assessment of objects or entities subject to multiple factors. This method offers clear and systematic results, effectively resolving fuzzy and difficult-to-quantify problems and is suitable for solving various non-deterministic problems.

[0102] The number of unauthorized accesses, control status evaluation value, and network status evaluation value are weighted and summed according to the weight value to obtain the trust impact value. Based on the trust impact value and the trust value of the application before the update, the current trust value of the application, T, is calculated. i,c2 :

[0103] T i,c2 =T i,c1 -(αTO i +βTC i,c +γTP i,c )+δS(T i,c1 )

[0104] Among them, T i,c1 represents the trust value of northbound application i before the update. α, β, and γ are penalty coefficients, δ is the reward coefficient, and S is the Sigmoid function.

[0105] It is understandable that, in order to facilitate calling the trust value before the update, a trust value record table may be set for each northbound application.

[0106] In one embodiment, before querying whether the access request has access rights, the method further includes:

[0107] The identity token in the access request is verified. If the verification is passed, the identity authentication is successful and the access request is issued. If the verification is not passed, the identity authentication fails and the access request is discarded.

[0108] Specifically, before checking whether an access request has access rights, the northbound application issuing the access request can first be authenticated. This authentication method involves verifying the identity token in the access request. If the identity token verification fails, the access request is directly discarded. Successful verification of the identity token indicates that the northbound application has been authenticated successfully. After further checking whether the access request has access rights, the access request is issued. In this embodiment, identity authentication is added, and zero-trust authentication and permission control are performed on the northbound application, further ensuring the security of the SDN network.

[0109] In one embodiment, before receiving the access request sent by the northbound application, the method further includes:

[0110] Receive service registration information sent by the northbound application before it goes online, and generate an identity token and initial access rights for the northbound application according to the service registration information.

[0111] Specifically, to authenticate northbound applications, they must first register for services before going live to obtain an identity token. Furthermore, initial access permissions can also be obtained by applying for both the service and the identity token. Service registration requires submitting service registration information, including the software version number, developer information, and the northbound application ID. Administrators review this information and, if successful, generate initial access permissions and an identity token for the northbound application based on it.

[0112] The northbound interface security assurance architecture provided by the present invention is described below. The northbound interface security assurance architecture described below and the northbound interface security assurance method described above can be referenced to each other.

[0113] like Figure 5As shown, the northbound interface security assurance architecture provided by the present invention includes: a northbound interface access agent 102, a trust assessment engine 106 and an access control engine 105, wherein the trust assessment engine 106 includes an access request assessment module, a controller status assessment module, a network status assessment module and a multi-mode feature fusion trust assessment module; the northbound interface access agent 102 is used to receive an access request sent by a northbound application 101, query whether the access request has access rights, and when the access request has access rights and is a legitimate access request, send the legitimate access request to the controller of the control plane 103; the access request assessment module is used to obtain the number of unauthorized accesses of the northbound application 101 between the legitimate access request and the previous legitimate access request; the controller status assessment module is used to obtain the state parameters of the controller before responding to the legitimate access request and the state parameters of the controller before responding to the legitimate access request. The state parameters of the controller after the request are asked, so as to obtain the control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request; the network state evaluation module is used to obtain the state data of the network domain acted by the northbound application 101 before responding to the legitimate access request and the state data of the network domain acted by the northbound application after responding to the legitimate access request on the data plane 104 that interacts with the control plane 103, so as to obtain the network state evaluation value of the network domain based on the state data of the network domain before and after responding to the legitimate access request; the multi-mode feature fusion trust evaluation module is used to update the trust value of the application according to the number of unauthorized accesses, the control state evaluation value and the network state evaluation value; the access control engine 105 adjusts the permissions of the application according to the updated trust value of the application.

[0114] Specifically, such as Figure 6 As shown in , the trust assessment engine 106 is provided with an application trust value record table, which is specifically used to store the trust value of each northbound application 101. The trust value calculated by the multimodal feature fusion trust assessment module, that is, the updated trust value, is also stored in the above-mentioned application trust value record table, so that the multimodal feature fusion trust assessment module can call it the next time it updates the trust value.

[0115] It is understandable that if Figure 7As shown in , the access control engine 105 is provided with an application permission mapping table specifically for storing the current permissions of each northbound application 101 and a list of permission categories for northbound applications 101. The access control engine 105 is also provided with a dynamic permission control module. This module is used to dynamically adjust the permissions of northbound applications 101 based on the trust value of northbound applications 101, according to the existing permissions of northbound applications 101 and the permission categories in the permission category list in the application permission mapping table, and to update the permissions in the application permission mapping table. For example, if the initial permission of northbound application 101A is a, then the permission record of northbound application 101A in the permission mapping table is a. When the permission of northbound application 101 is adjusted to b, the permission of northbound application 101A in the permission mapping table is updated to b. The initial permission of northbound application 101 can be the permission stored in the application permission mapping table of access control engine 105 after northbound application 101 applies for initial permission from access control engine 105 and the application is approved.

[0116] In one embodiment, the controller state evaluation module is specifically configured to:

[0117] Acquire multiple state parameters of the controller before responding to the legal access request and multiple state parameters of the controller after responding to the legal access request;

[0118] Pre-setting graded indicator thresholds for each of the state parameters;

[0119] Calculating a change value of each state parameter of the controller before and after responding to the legal access request;

[0120] Determining a state loss score for each state parameter according to an indicator threshold corresponding to a change value of each state parameter;

[0121] A control state evaluation value of the controller is obtained based on the state loss scores of the plurality of state parameters.

[0122] In one embodiment, the network status assessment module is specifically configured to:

[0123] Acquire, on the data plane 104 interacting with the control plane 103, a plurality of status data of the network domain on which the northbound application acts before responding to the legitimate access request and a plurality of status data of the network domain on which the northbound application acts after responding to the legitimate access request;

[0124] Aggregating multiple state data of the network domain through a Bayesian network model or a Markov network model to obtain a network state evaluation value of the network domain;

[0125] The status data includes the bandwidth, packet loss rate and network delay of the network domain.

[0126] In one embodiment, the multimodal feature fusion trust assessment module is specifically used to:

[0127] Determine weights of the number of unauthorized accesses, the control status evaluation value, and the network status evaluation value according to a fuzzy comprehensive evaluation method;

[0128] Performing a weighted summation of the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value according to the weight value to obtain a trust impact value;

[0129] Based on the trust impact value and the trust value of the application before the update, the current trust value of the application is obtained and updated.

[0130] In one embodiment, before querying whether the access request has access rights, the northbound interface access agent 102 is also used to: verify the identity token in the access request. If the verification passes, the identity authentication is successful and the access request is issued. If the verification fails, the identity authentication fails and the access request is discarded.

[0131] Specifically, when the northbound application 101 sends an access request to the northbound interface access agent 102, it will attach an identity token to the request header -- header "TOKEN:<access_token> ", the northbound interface access agent 102 will intercept the access request, parse the access request, extract the identity token in the access request, and verify the identity token.

[0132] In one embodiment, Figure 8 As shown in the figure, the northbound interface security assurance architecture also includes:

[0133] The identity security infrastructure 107 is configured to receive service registration information sent by the northbound application 101 before going online, and generate an identity token and initial access rights for the northbound application 101 according to the service registration information.

[0134] Specifically, before going online, the northbound application 101 can send service registration information to the northbound interface access agent 102. The northbound interface access agent 102 forwards the service registration information to the identity security infrastructure 107. After the administrator checks the service registration information, the identity security infrastructure 107 generates an identity token and initial permissions for the northbound application 101, and returns the identity token to the northbound application 101 as a response to the service registration information.

[0135] The identity token of the northbound application will be sent to the northbound interface access agent 102 together with the access request, so that the northbound interface access agent 102 can authenticate the access request; after receiving the identity authentication call request from the northbound interface access agent 102, the identity security infrastructure 107 authenticates the identity token of the access request received by the northbound interface access agent 102.

[0136] It is understandable that the initial permissions of the northbound application 101 can also be generated through the identity security infrastructure 107. After the initial permissions are generated, the generated initial permissions are sent to the access control engine 105. The access control engine 105 stores them in the application permission mapping table to facilitate the northbound interface access agent 102 to query the permissions of the access request and the subsequent access control engine 105 to adjust the permissions of the northbound application 101.

[0137] The above-mentioned northbound interface security assurance architecture gives each northbound application 101 a digital identity, realizes the trusted identification of the northbound application 101, and builds an access control architecture based on the identity and initial permissions of the northbound application 101, and performs zero-trust authentication and permission control on the northbound application 101, further ensuring the security of the SDN network.

[0138] Specific examples:

[0139] Example 1: Access by unregistered applications:

[0140] The northbound application 101OFapp1 has not registered for service on the identity security infrastructure 107, so it does not have a valid identity token. When initiating an access request through the REST API of the northbound interface access agent 102, there is no valid identity token in the http access request header. Therefore, when the northbound interface access agent 102 receives the access request and finds that it is an illegal identity during identity authentication, it will directly discard the access request.

[0141] Example 2: Northbound application 101 sends a malicious flow table:

[0142] The northbound application 101OFapp2 first initiates a service registration request to the northbound interface access agent 102 as shown below: --data{appid=$ <appid>&develorer=$ <developer>}http: / / <access proxy IP>:port / onos / v1 / regist to request an identity token. After receiving the request, northbound interface access proxy 102 forwards it to identity security infrastructure 107. Identity security infrastructure 107 determines whether to issue an identity token to OFapp2 based on the policy defined by the network administrator. After generating the identity token, identity security infrastructure 107 returns the identity token to OFapp2 as a response to the service registration request.

[0143] After obtaining the identity token, the northbound application 101OFapp2 initiates a flow table to send an access request: --request POST --header "TOKEN: <token>"--data"$ <flow>"http: / / <access proxy IP>:port / onos / v1 / flows / {deviceId}. The northbound interface access proxy 102 parses the identity token in the access request header and submits it to the identity security infrastructure 107 for authentication. After authentication, the access control engine 105 determines whether the northbound application 101 has the corresponding access rights based on the access request type of the northbound application 101. If so, the access request is sent to the ONOS northbound interface access proxy 102 for execution.

[0144] When the access request is executed, the controller status assessment module and the network status assessment module will continuously monitor the controller status parameters and network status parameters, and perform fusion calculations on them through the multi-mode feature fusion trust assessment module. Malicious flow tables will lead to an increase in the network packet loss rate, so the trust value of the northbound application 101 will decrease after the fusion calculation. After the trust value of the northbound application 101 decreases, the access control engine 105 will reduce the permissions of the northbound application 101. When the northbound application 101 initiates the flow table to send an access request again, due to permission issues, the northbound interface access agent 102 will directly reject the access request.

[0145] Example 3: Application initiates illegal access request

[0146] After completing the above service registration request, the northbound application 101OFapp3 initiates a flow table deletion request to the northbound interface access agent 102: --request DELETE --header "TOKEN: <token>"http: / / <access proxy IP>:port / onos / v1 / / flows / {deviceId} / {flowId}." Northbound interface access proxy 102 intercepts the request and obtains the request type of northbound application 101. It first authenticates OFapp3. After passing the authentication, northbound interface access proxy 102 queries access control engine 105 for access permissions for northbound application 101. If northbound application 101 does not have permission to delete flow tables, northbound interface access proxy 102 denies OFapp3's access request.

[0147] The northbound interface security assurance architecture provided by the present invention performs a long-term trust assessment on the access process of northbound applications 101 by evaluating the controller status, the network status, and the access request information, and adjusts the permissions of northbound applications 101 based on the assessment results. On the one hand, the architecture does not require static analysis of the byte code of the northbound application, does not change the access logic of the northbound application, and does not require the deployment of a specific environment. On the other hand, the access control mechanism for northbound applications 101 comprehensively considers multiple factors, implements refined management of access control of northbound applications 101, and manages the access permissions of northbound applications 101 based on trust assessment, which can effectively respond to malicious behavior of northbound applications 101.

[0148] Figure 9 An example of a physical structure diagram of an electronic device is shown below. Figure 9 As shown, the electronic device may include: a processor (processor) 910, a communication interface (Communications Interface) 920, a memory (memory) 930 and a communication bus 940, wherein the processor 910, the communication interface 920, and the memory 930 communicate with each other through the communication bus 940. The processor 910 can call the logic instructions in the memory 930 to execute the northbound interface security assurance method, which includes: receiving an access request sent by a northbound application; querying whether the access request has access rights, and when the access request has access rights and is a legitimate access request, sending the legitimate access request to the controller of the control plane; obtaining the number of unauthorized accesses of the northbound application between the legitimate access request and the previous legitimate access request; obtaining the state parameters of the controller before responding to the legitimate access request and the state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request; obtaining the state data of the network domain acted by the northbound application before responding to the legitimate access request and the state data of the network domain acted by the northbound application after responding to the legitimate access request on the data plane interacting with the control plane, so as to obtain a network state evaluation value of the network domain based on the state data of the network domain before and after responding to the legitimate access request; updating the trust value of the application according to the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value; and adjusting the permissions of the application according to the updated trust value of the application.

[0149] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0150] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the northbound interface security assurance method provided by the above methods, which includes: receiving an access request sent by a northbound application; querying whether the access request has access rights, and when the access request has access rights and is a legitimate access request, sending the legitimate access request to the controller of the control plane; obtaining the number of unauthorized accesses of the northbound application between the legitimate access request and the previous legitimate access request; obtaining the state parameters of the controller before responding to the legitimate access request and the number of unauthorized accesses of the controller in response to the ... The method comprises the steps of: obtaining the status parameters of the controller before and after responding to the legitimate access request, obtaining the control status evaluation value of the controller based on the status parameters of the controller before and after responding to the legitimate access request; obtaining the status data of the network domain acted by the northbound application before responding to the legitimate access request and the status data of the network domain acted by the northbound application after responding to the legitimate access request on the data plane interacting with the control plane, so as to obtain the network status evaluation value of the network domain based on the status data of the network domain before and after responding to the legitimate access request; updating the trust value of the application according to the number of unauthorized accesses, the control status evaluation value and the network status evaluation value; and adjusting the permissions of the application according to the updated trust value of the application.

[0151] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the northbound interface security assurance method provided by the above-mentioned methods, the method comprising: receiving an access request sent by a northbound application; querying whether the access request has access rights, and when the access request has access rights and is a legitimate access request, sending the legitimate access request to the controller of the control plane; obtaining the number of unauthorized accesses of the northbound application between the legitimate access request and the previous legitimate access request; obtaining the state parameters of the controller before responding to the legitimate access request and the state parameters of the controller after responding to the legitimate access request , to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legal access request; obtain the state data of the network domain acted by the northbound application before responding to the legal access request and the state data of the network domain acted by the northbound application after responding to the legal access request on the data plane that interacts with the control plane, to obtain a network state evaluation value of the network domain based on the state data of the network domain before and after responding to the legal access request; update the trust value of the application according to the number of unauthorized accesses, the control state evaluation value and the network state evaluation value; adjust the permissions of the application according to the updated trust value of the application.

[0152] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0153] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.< / token> < / flow> < / token> < / developer> < / appid>

Claims

1. A northbound interface security assurance method, characterized in that: include: Receive access requests from northbound applications; querying whether the access request has access rights, and when the access request has access rights and is a legitimate access request, sending the legitimate access request to a controller of the control plane; Obtaining a number of unauthorized accesses by the northbound application between the legitimate access request and a previous legitimate access request; acquiring state parameters of the controller before responding to the legitimate access request and state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request; Obtaining, on a data plane interacting with the control plane, state data of the network domain on which the northbound application acts before responding to the legitimate access request and state data of the network domain on which the northbound application acts after responding to the legitimate access request, to obtain a network status evaluation value of the network domain based on the state data of the network domain before and after responding to the legitimate access request; updating the trust value of the application according to the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value; The permissions of the application are adjusted according to the updated trust value of the application.

2. The northbound interface security assurance method according to claim 1, characterized in that: The acquiring the state parameters of the controller before responding to the legitimate access request and the state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request, includes: Acquire multiple state parameters of the controller before responding to the legal access request and multiple state parameters of the controller after responding to the legal access request; Pre-setting graded indicator thresholds for each of the state parameters; Calculating a change value of each state parameter of the controller before and after responding to the legal access request; Determining a state loss score for each state parameter according to an indicator threshold corresponding to a change value of each state parameter; A control state evaluation value of the controller is obtained based on the state loss scores of the plurality of state parameters.

3. The northbound interface security assurance method according to claim 1, characterized in that: The obtaining, on the data plane interacting with the control plane, the status data of the network domain acted upon by the northbound application before responding to the legitimate access request and the status data of the network domain acted upon by the northbound application after responding to the legitimate access request, to obtain a network status evaluation value of the network domain based on the status data of the network domain before and after responding to the legitimate access request, includes: Acquire, on a data plane interacting with the control plane, a plurality of status data of the network domain on which the northbound application acts before responding to the legitimate access request and a plurality of status data of the network domain on which the northbound application acts after responding to the legitimate access request; Aggregating multiple state data of the network domain through a Bayesian network model or a Markov network model to obtain a network state evaluation value of the network domain; The status data includes the bandwidth, packet loss rate and network delay of the network domain.

4. The northbound interface security assurance method according to claim 1, characterized in that: The updating of the trust value of the application according to the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value includes: Determine weights of the number of unauthorized accesses, the control status evaluation value, and the network status evaluation value according to a fuzzy comprehensive evaluation method; Performing a weighted summation of the number of unauthorized accesses, the control state evaluation value, and the network state evaluation value according to the weight value to obtain a trust impact value; Based on the trust impact value and the trust value of the application before the update, the current trust value of the application is obtained and updated.

5. The northbound interface security assurance method according to any one of claims 1 to 4, characterized in that: Before querying whether the access request has access rights, the method further includes: The identity token in the access request is verified. If the verification is passed, the identity authentication is successful and the access request is issued. If the verification is not passed, the identity authentication fails and the access request is discarded.

6. The northbound interface security assurance method according to claim 5, characterized in that: Before receiving the access request sent by the northbound application, the method further includes: Receive service registration information sent by the northbound application before it goes online, and generate an identity token and initial access rights for the northbound application according to the service registration information.

7. A northbound interface security assurance architecture, characterized in that: include: Northbound interface access agent, trust assessment engine and access control engine, the trust assessment engine includes access request assessment module, controller status assessment module, network status assessment module and multi-mode feature fusion trust assessment module; The northbound interface access agent is used to receive an access request sent by a northbound application, query whether the access request has access rights, and when the access request has access rights and is a legitimate access request, send the legitimate access request to the controller of the control plane; The access request evaluation module is used to obtain the number of unauthorized accesses by the northbound application between the legitimate access request and the previous legitimate access request; The controller state evaluation module is used to obtain state parameters of the controller before responding to the legitimate access request and state parameters of the controller after responding to the legitimate access request, so as to obtain a control state evaluation value of the controller based on the state parameters of the controller before and after responding to the legitimate access request; The network status evaluation module is used to obtain, on a data plane interacting with the control plane, status data of the network domain acted upon by the northbound application before responding to the legitimate access request and status data of the network domain acted upon by the northbound application after responding to the legitimate access request, so as to obtain a network status evaluation value of the network domain based on the status data of the network domain before and after responding to the legitimate access request; The multi-mode feature fusion trust evaluation module is used to update the trust value of the application according to the number of unauthorized accesses, the control state evaluation value and the network state evaluation value; The access control engine adjusts the permissions of the application according to the updated trust value of the application.

8. The northbound interface security assurance architecture according to claim 7, characterized in that: Before querying whether the access request has access rights, the northbound interface access agent is also used to: verify the identity token in the access request. If the verification passes, the identity authentication is successful and the access request is issued. If the verification fails, the identity authentication fails and the access request is discarded.

9. The northbound interface security assurance architecture according to claim 8, characterized in that: Also includes: The identity security infrastructure is used to receive service registration information sent by the northbound application before it goes online, and generate an identity token and initial access rights for the northbound application based on the service registration information.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the northbound interface security assurance method according to any one of claims 1 to 6 is implemented.

Images